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Li et al. presented a protocol [Int. Journal of Quantum Information, Vol. 4, No. 6 (2006) 
899-906] for quantum key distribution based on entanglement swapping. In this protocol 
they use random and certain bits to construct a classical key and they claim that this key 
is secure. In our article we show that the protocol by Li et al. is insecure presenting a new 
type of attack strategy which gives an adversary full information about the key without 
being detected. This strategy is based on entanglement swapping, too, and manages 
to preserve the correlation between the measurement results of the legitimate parties. 
Further we present a modified version of the protocol and show that it is secure against 
this new attack strategy. 
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1. Introduction 

Entanglement swapping — is a phenomenon where 2 or more qubits which didn't 
interact in the past are brought into an entangled state. For example, two par- 
ties Alice and Bob share the Bell states |$~'')i2 and |$^)34 such that Alice is in 
possession of qubits 1 and 3 and Bob of qubits 2 and 4. If Alice performs a mea- 
surement in the Bell basis on qubits 1 and 3 she will end up with one of the four 
Bell states. Simultaneously Bob's qubits 2 and 4 are also brought into a Bell state. 
This measurement can be described by the equation 

|$+)l2 ® |$+)34 = l{ |*+)l3|$+>24 + |$~)l3|$~>24 

+ |^'+)l3|* + )24 + |*")l3|*")24) (1) 



This equation shows that Alice's result is completely random, i.e. she will obtain 
any of the four Bell states with equal probability. But the state of the qubits 2 and 
4 is completely determined by the result of Alice's measurement . This correlation 
is used in a number of key distribution protocols | 2 | 3 | 4 | 5 | 6 |7|81 share a secret key 
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between Alice and Bob. Since the practical realization of entanglement swapping 
is rather complex to achieve with today's technology none of these QKD protocols 
has been implemented yet. 

Also Li et al. presented a QKD protocol ^ based on entanglement swapping 
which not only produces random key bits but also certain key bits. This is achieved 
by introducing a Pauli operation in eq. ([T]) as it will be described in detail in section 
[2] As it is shown in '9' this protocol is secure against an intercept/resend attack as 
well as a collective attack. But we will present an attack strategy in section [3] which 
is based on a 6-qubit state. This state is more complex than the system of the 
sender and the receiver, but it provides an adversary with full information about 
the key shared between the two parties. 

The main idea of this attack is that the adversary Eve entangles herself with 
Alice and Bob using a state which preserves the correlations of Alice's Bell state 
measurement. Further this state contains additional information which allows Eve 
to eavesdrop Bob's secret result. An attack where Eve is entangled with one party 
was presented by Zhang, Li and Guo^I^on the protocol of Cabellol^but it wouldn't 
work for the protocol in [S] since Eve wouldn't stay undetected. 

We will also make a proposal how to secure the protocol against this new attack 
strategy. This can be achieved using a Hadamard operation and we will describe 
the new version in detail in section 3) In section [5] we will discuss the security of 
our new version. 

2. The Original Protocol 

Alice creates 2n EPR pairs, each in a Bell state, e.g. 1$"^). In the following we will 
focus on the simple case n = 1, where Alice and Bob share the states |$^)i2 and 
|*i'^)34: which are publicly known. In [9] Li et al. start the protocol with preshared 
entangled states which is a very strong assumption because the qubits have to 
be shared somehow between the two parties. But in the security analysis in [9] an 
adversary Eve is granted the possibility to interact with the Bell states. Thus we 
can conclude that there have to be some qubits in transit between Alice and Bob. 
There are two possible ways to share the Bell states between the legitimate parties: 
either one party, e.g. Alice, prepares both Bell states and sends two qubits to the 
other party or both parties prepare one Bell state and they exchange two qubits. 

The first scenario is insecure against a simple intercept-resend attack: If Alice 
prepares the Bell states |$"'")i2 and |$"'')34 and sends qubits 2 and 4 to Bob Eve 
can intercept these qubits and perform a Bell state measurement on them. This will 
bring qubits 1 and 3 also into a Bell state which is known to Eve. Then she forwards 
qubits 2 and 4 to Bob. Thus Eve has full information about Alice's and Bob's secret 
measurement result and is able to eavesdrop the key perfectly. Therefore we will 
assume that Alice prepares |$+)i2 and Bob prepares |<1'^)34 and that they exchange 
the qubits 2 and 3 (cf. picture (2) in figure [T|). 

Alice randomly chooses one of the four Pauli operations, /, cFx, cTy or Uz and 
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applies it to qubit 1 (cf. picture (3) in figure [1]). Alice's operation will generally be 
described as cr^\ where the superscript (i) denotes that it is applied on qubit i. 
As a next step Alice performs a Bell state measurement on qubits 1 and 3 in her 
possession (cf. picture (4) in figure [J). 

With this measurement the effect of entanglement swapping arises and entangles 
Bob's qubits 2 and 4. Following the equation 

<jT\^^)i2 |<i> + )34 = l[ |<i>+)l34'^|$ + )24 + |<i>-)l34'^|<i>-)24 

+ |vI' + >i34'^|* + )24 + |*-)l3^i'^ 1*^)24) (2) 

Alice can determine in which state Bob's qubits are after her Bell state measurement 
if she applied the operation a a on qubit 1. Additionally, she can compute also what 
the state of qubits 2 and 4 would be, if she didn't apply any operation on qubit 1 
using eq. Ilj from above. Now Alice announces to Bob that she made a Bell state 
measurement but keeps her result secret. 

To infere Alice's result Bob performs a Bell state measurement on qubit 2 and 
4 in his possession. Since he does not know yet which operation Alice applied and 
in which state qubits 1 and 2 have been before the measurement he does not know 
the exact state of qubits 1 and 3. With the help of eq. ^ he can at least deduce 
in which state qubits 1 and 3 should be if Alice didn't apply anything to qubit 1. 
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Fig. 1. An illustration of the original protocol by Li at al. ®. Here is chosen for Alice's secret 
operation and |'I'~)i3 as Alice's result of the Bell state measurement. 
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This is called Alice's imaginary result. 

To get the correct state of qubits 1 and 3 Bob asks Alice about her result but 
keeps his own result secret. Using the information about Alice's and his own result 
Bob can deduce which Pauli operation Alice applied. Alice and Bob now share 
information about Alice's randomly chosen operation and the result Bob obtained, 
which is also random. They use these two pieces of information to extract a classical 
raw key. Therefore they agree beforehand on a mapping of Bell states onto classical 
2-bit strings, e.g. 

|$+) — >00 |$"> — >01 1*+) — >10 |*"> — >n (3) 

as well as of Pauli operations onto classical 2-bit strings, i.e. 

/ — » 00 (7^ — >0l <jy — > 10 cr^ — > 11 (4) 

If we take the general case with 2n EPR pairs Alice and Bob repeat these steps 
for all the pairs. In the end they publicly compare a certain number of bits of the 
generated raw key to detect an eavesdropper. 

3. A Perfect Attack Strategy 

In this section we discuss an attack strategy where Eve is able to perfectly eavesdrop 
the secret key of Alice and Bob without being detected. Therefore she uses the six 
qubit state (cf. picture (1) in figured]) 

\S)PQRSTU = ^( \000000) PQRSTU + \00n01) PQRSTU 

+ |oioiii)pQflSTO + \onoio)pQRSTu 

+ |100110)pQflSTO + \lOlOn)pQRSTU 

+ |110001)pQflSTO + IllllOO) pqpsto) (5) 

This state is rather complex and not easy to generate (cf. appendix) but it has the 
special property that it can be written as 

\S)pQRSTU = ^( |*+)pp |*+)q5 ® |*+)tc/ 

+ |*")PP® |$")qS<»|*")t(7 
+ |^' + )PP® |«' + )q5® |* + )tC/ 

+ |4'">pp® |1'">QS«) I*")™) (6) 

That means, a measurement on qubits P and R as well as Q and S yields in the 
same result as it would be expected from entanglement swapping in eq. ([T]) . Further 
the remaining two qubits T and U are in the same state as the qubits Q and S. Eve 
can use this fact to obtain enough information to deduce the secret measurement 
results of Alice and Bob if she somehow manages that the two parties share the 
state |i5) instead of two Bell states. That can be achieved easily using entanglement 
swapping on qubits 2 and 3 in transit together with her six qubits. 
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When Alice sends out qubit 2 and Bob qubit 3 Eve preforms Bell state mea- 
surements on both of them with respective qubits from \5) pqrstu (cf- picture (2) 
in figure [2]). A problem is that Eve, at first, doesn't know which initial state Alice 
prepared. But, as we will show in the next paragraphs, she can overcome this prob- 
lem fairly easy. Eve's first Bell state measurement on qubits 2 and P is described 
in eq. ([7|). (As already pointed out above, we will use a a to describe Alice's secret 
Pauli operation.) 



® \5) PQRSTU 



a«i=(|00)i2 + |ll) 




^y-i^^ ■ ,-,12) ^{\000000)pQRSTU + \00n01)pQRSTU 

010111>Pq;jSTO + 1011010) PQi?5TO + 1 1001 10) PQP5TO 

101011)pQpsTO + 1 110001) PQpsTO + |111100)pqpsto) 

y'-A^ ^ ( 1 000000) iQpsTt/ + |001101)iQpsTr/ 
010111)iQpsTO + |011010)iQpsTO + 1 100110) iQpsTO 

101011)iQpSTO + |110001)iQpSTO + |111100)iQpsTO 



2P 



I2P 



2P < 



7i'^^(|000000)iQpsTC/ + |001101)iQpsTO 

010111)iQpSTO + |011010)iQpsTO - |100110)iQP5TO 
101011)iQpSTO - |110001)iQpsTt/ - 1 111100) 



CTi''^(^|000110)iQpsTC/ + |001011)iQpsTO 
010001) iQpsTO + |011100)iQpsTO + 1 100000) iQpsTO 

101101) IQPSTO + |110111)lQfiSTC/ + 1 111010) IQPSTO 

c7i'^-^(|000110)iQpsT[/ + |001011)i 



1 /, 



IQRSTU 



010001)iQpsTO + |011100)iQpsTO - |100000)iQP5TO 

101101)iQpST[/- |110111)lQfiSTO- |111010)iQpsTO^ 



(7) 



At this point Eve can not clearly say which state the qubits 1, Q,R,S,T and U 
are in. All four results of her Bell state measurement are equally likely and she 
has absolutely no information about the operation a a- Nevertheless, Eve is able to 
transform the 6-qubit state in a way that it is always in the state cr^A"^ \6) iq rstu ■ 
Therefore she performs a (Jx operation on qubits S and T if she gets |vE'+)2P or does 
nothing if her result is |<1'+)2P- To correct the negative signs in case Eve obtains 
a |$~)2P she performs a cr^ on qubits 5* and U. In case of |vE'~)2P she first has to 
apply the operator on qubits S and T and then the CTz operator on qubits S and 
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U. 

The second Bell state measurement is performed on qubits 3 and S. Again, the 
resulting 6-qubit state is not entirely known but it can be one out of four possible 
states. We won't describe this Bell state measurements explicitly but we want to 
stress that Eve is able to bring the 6 qubits in the state (T^^\5)iQmTU ■ Therefore 
she uses a similar method as described above applying the Pauli operations cJj. and 
Uz on qubits R, T and U . 

Now Eve sends qubit R to Alice and qubit Q to Bob and keeps qubits T and 
U by herself (cf. picture (4) in figure [2|). Alice and Bob, who are not aware of 
Eve's intervention follow the protocol and perform Bell state measurements on their 
respective particles (cf. pictures (5) and (6) in figure [2]). If we look at the 6-qubit 
state o^^\5)iQmTU , Alice's Bell state measurement on qubits 1 and R changes the 
state in a way that it leaves the qubit pairs Q, 4 and T, U in an entangled state. 
This can be seen from the alternative description of the state <j''^\5)iqratu in eq. 
(O and picture (7) in figure [2]). 



\"llQRiTU 



,(1) 



2^2 



i^(|000000)iQfi4TO- 
010111)iQWt/ 

101011) 



|001101)iQfl4TO 

|011010)iQK4TO + |100110)iQfl4T[/ 
|110001)iQfl4TO + |111100)iQfl4T[/ 



)1R ' 



® o(|0000)q4T[/ + |0011)q4T[/ 



+ |1100)q4to + |1111)q4to 

+ <j'i^\^-)lB. ^(|0000)q4TO - |0011)q4TO 

-|1100)q4TO + |1111)q4TO 

+ ^^A l*^>lfl ® I (|0101)q4TC/ + |0110)q4TO 

+ |1001)q4to + |1010)q4to 
+ a^'^|*-)iH®-(|0101) Q4TU + |0110)q4T(7 

- |1001)q4TO- |1010)q4to) 



(8) 



Alice gets each possible result with equal probability of i as she would expect 
it. Further, Bob's Bell state measurement will end up with certainty in a specific 
Bell state, which is fully dependent on Alice's result. Due to the special choice 
of the state \S) the correlation between his and Alice's result is preserved as they 
would expect it if no eavesdropper was present. Thus the presence of Eve won't be 
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detected when Alice and Bob compare some bits of the raw key. Additionally, it 
leaves the qubits T and [/, which are in Eve's possession, in the very same state 
Bob obtains as result (cf. also picture (7) in figure [2]). This is easy to see if we look 
at the alternative description in the Bell basis of the remaining four qubits Q, 4, T 
and U after Alice's measurement 



At this time. Eve has full information about Bob's secret measurement. That 
means. Eve has as much information as Bob and thus can obtain the classical secret 
raw key in the same way Bob does: From her result of the Bell state measurement 
Eve can compute Alice's imaginary result. Moreover, when Alice publicly announces 
her result. Eve is able to infere which Pauli operation Alice has chosen. Thus Eve 
knows both parts of the shared secret information. Therefore she easily can infere 
the classical bit string which is used as a raw key by Alice and Bob and so she is 
able to obtain the secret key, too. 

Instead of performing the Bell state measurements on the qubit pairs 2, P and 

3, S as soon as she receives them. Eve has the opportunity to delay her measure- 
ment and immediately send qubit R to Alice (cf. picture (2) in figure [5]). With 
this strategy Eve is able to overcome operations Alice applies on qubit 1 but she 
introduces a much higher error rate as we will describe in section [5l Another, but 
rather strong, assumption is that Eve is in control of Alice's and Bob's EPR source. 
That means she is able to distribute the state \5) pqrstu between her and the two 
parties without further Bell state measurements. In this case Alice's measurement 
on qubits P and R leaves Bob's qubits in a correlated state and Eve with the full 
information about the results, as described above. Since Alice and Bob can prepare 
their EPR source themself this assumption is not very practical. 

4. The Modified Protocol 

The protocol can be improved by performing a Hadamard operation before Alice 
applies her secret Pauli operation on qubit 1 (cf. picture (3) in figure [3|). The 
Hadamard operation alters the initial state in a way that Eve can't eavesdrop the 
secret key without introducing a certain error rate. Thus Alice and Bob can detect 
her easily as it will be shown in section [5l 

Due to the use of the additional Hadamard operation it is not important any 
more wether Alice prepares both Bell states or each party prepares a Bell state 
by its own. To stay consistent with the above descriptions of the protocol and the 
attack we will discuss the scenario where Alice prepares the state |<I'+)i2 and Bob 
prepares |$"'")34 (for the simple case n — 1). Ahce sends out qubit 2 to Bob and he 
sends qubit 3 to Alice. When she receives Bob's qubit she randomly applies either 




(9) 



28, 2008 12:8 Novel' Attack'Strategy 



8 



the identity operator / or the Hadamard operator 




( 



1 -1 



1 1 



) 



(10) 



on qubit 1. This alters the initial state to 



i/(l)|$+)l2® |$ + ) 



34 



|w + >i2 ® |$ + )34 



(11) 



where |a;+)i2 is one of the four possible superpositions of Bell states, i.e. 





1 



(|$T)^2±|*^)l2 
(|*T)l2± |$±)l2 



12 — 



x/2 





1 



(12) 



12 — 



V2 



Then Alice applies her secret Pauli operation a a on qubit 1 and performs a Bell 
state measurement on qubits 1 and 3 (cf. picture (5) in figure [31). This Bell state 
measurement can be described as 



Further she publicly tells Bob wether she has applied the H operator or not. If 
she did so. Bob applies the H operator on qubit 2 and otherwise he does nothing 
(cf. picture (6) in figure [3]). As we can see from eq. ([72]) a repeated apphcation 
of the Hadamard operator eliminates the superposition and the correlation from 
the original Bell state measurement is preserved. In the end Bob performs a Bell 
measurement on qubits 2 and 4 and computes Alice's actual and imaginary result 
as it is described in the original protocol. 

5. Security Analysis 

In the following we will provide a security analysis of the modified protocol. Since 
the application of the Hadamard operation is just a minor change of the original 
protocol, the modified version is also secure against an intercept/resend attack as 
well as a collective attack, as described in HI Therefore we will first inspect Eve's 
probability to stay undetected if she follows the same attack strategy just described 
in section [31 If Alice does not apply the Hadamard operator Eve's attack will be 
successfull as we already pointed out above. Thus we will discuss the case where 
Alice performs the Hadamard operation on qubit 1 (cf. figure [J). Due to the fact 
that the Hadamard operation alters the initial state as we have seen in eq. (|TT|) 
Eve's first Bell state measurement on qubits 2 and P will also change as described 



\u)+)i2 ® |$ + >34 = TT 




(13) 
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in eq. ([141) . 



ax'H'^'' 1^-^)12 «) \6)pQRSTU 



2P 



«)f7^^^i/(^)^(|000000) 



1$ 



2V2* 

+ |010111)iQflSTC/ 
+ |101011)iQflSTO 

+ |010111)iQfl5TO 
-|101011)iQfl5TO 

+ |010001)iQflSTC/ + 

+ |101101)iQfl5TO + 

+ |010001)iQfl5TO + 
-|101101)iQflSTC/- 



IIQRSTU ' 

011010)iQflSTO- 
110001)iQflSTO- 

|000000)lQJ^STO- 
011010) iQflSTO - 
110001) iQKSTO- 

1000110) iQj^sTO 
011100)iQi?sTO- 

110111) iQi^STt/ - 

1000110) lQi^sTO 

011100)iQi^5TO- 
110111) iQflSTC/ - 



- 1001101) iQijsTc/ 
|100110)iQflSTc/ 

|111100)lQflSTO) 

-|001101)iQflSTi/ 
|100110)iQflSTO 

|111100)lQflSTO) 

^ |001011)iQflSTC/ 
1 100000) iQflSTC/ 

|111010)iQflSTO) 

^ 1001011) iQi^sTO 
1 100000) iQflSTO 

|111010)iQflSTO) )(14) 
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Fig. 2. An illustration of the new attack strategy described in section [3] Again ax is chosen as 
Alice's secret operation and \^~)ir as Alice's result of the Bell state measurement. 
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As it has been shown in section [3] Eve is able to change the resulting states of her 
measurements such that she will always end up with a slight variation of her initial 
state. A similar argument holds for Eve's second measurement on qubits 3 and S. 
Thus the state after these two measurements is (cf. picture (6) in figure S]) 

\S')iQmTu = <tTh^^^\S)iqr4tu (15) 

Then Eve sends out qubit R to Alice and qubit Q to Bob. When Alice performs 
her Bell state measurement the state \S')iqr4tu can be described as in eq. pB]) (cf. 
also picture (7) in figured]). 

+ |010111)iQH4TC/ + |011010)iQfl4TO + |100110)iQfl4TO 
+ |101011)iQfl4TC/ + |110001)iQi?4TO + |111100)iQfl4TO) 

" ^ ( '^A^l*+>i^ ^ ^ (|0000)q4to - |0011)q4T[/ 

- |1100)q4TO + |1111)q4TO + |0101)q4TO 
+ |0110)q4tc/ + |1001)q4tc/ + |1010)q4TC/) 

+ CJ^A\'i'')lR ® ^(|0000)q4TO + |0011)q4TO 

+ |1100>Q4Tr/ + |1111)q4T[/ - |0101)q4tc/ 
+ |0110)q4tc/ + |1001)q4tc/ - |1010)q4to) 

+ (T^'^|^' + )lfl® ^(|0101)q4TC/-|0110)q4TJ/ 

- |1001)q4TC/ + |1010)q4TC/ + |0000)q4TC/ 
+ |0011)q4to + |1100)q4TO + |1111>Q4to) 

+ a'i^\^-)iR® ^{\0101)QiTU + \OnO)Q4TU 

+ \1001)q4tu + |1010)q4T[/ - |0000)q4tc/ 

+ |0011)q4T[/ + |1100)q4to - |1111)q4to) ) (16) 



For reasons of simplicity we will assume that Alice's result is cr^^"* |$^)i_r as it 
is illustrated in picture (8) in figure 2] (the computations for any other result are 
analog) . Bob also applies the Hadamard operator on qubit Q in his possession and 
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thus alters the state of qubits Q, 4, T and U to 

i ( |0000)Q4Ta + |1000)q4TC/ + |0011)q4TO + \WU)q4TU 

+ |0100)q4to - |1100)q4to + |0111)q4to - |1111)q4TO 
- |0101)q4to - |1101)q4to + |0110)q4to + |1110)q4to 

+ |0001)q4TC/ - |1001)q4TO - |0010)q4TC/ + |1010)q4TC/ 

which can be alternatively written as 

From this it is easy to see that Bob will get the expected result, |$^)q4 only with 
50% probability. In the other half of the cases he will obtain |\I'+)q4. Alice and Bob 
will detect this error when they check the correlation between their results. 
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Fig. 3. An illustration of the modified protocol presented in section |4] Alice performs the 
Hadamard operation before she applies her secret operation ax- Again, |^^)i3 is assumed to 
be Alice's result of the Bell state measurement. 
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That means in i of the cases, when Ahce doesn't apply the Hadamard opera- 
tion, Eve will stay undetected with certainty. In the other half of the cases when 
Alice performs the Hadamard transformation on qubit 1 Eve will be detected with 
probability ^. These probabilities are valid for the simple case (n = 1) where Alice 
and Bob share only 2 Bell states. In general, Alice and Bob share 2n entangled 
qubit pairs and then they will detect Eve with the probability 



which can be brought close to 1 for large n. 

A possibility for Eve to overcome the effect of the Hadamard operation is to 
apply a H operation herself on the qubits P and Q before the protocol starts. This 
changes the initial state \S)pQjiSTU to H^^^ H'^'^^\5) pqrstu and in the course of 
the protocol Alice and Bob's application of the Hadamard operator will invert Eve's 
operations. In detail, eq. fTSl changes to 

\5')iQmTU = a^2^H^'^H'^'^H^'^^S)iQmTU = ^i'^if('^V>iQWC/ (20) 
and further, after Bob's application of the Hadamard operation 

which is equal to the state from eq. [H Thus, the attack reduces to the version 
described in section [3] and Eve will obtain full information about the key whenever 
Alice decides to perform the H operation. In all the other cases Eve will introduce 
an error equal to eq. [19] due to her Hadamard operations, which is easy to see 
following the arguments in the paragraphs above. At this point we want to stress 
that Alice and Bob will become suspicious if they find errors only in those cases 
when Alice does (or does not, respectively) perform the Hadamard operation. Thus, 
a better strategy for Eve is to randomly apply the two Hadamard operations on 
qubits P and Q. She will introduce the same error rate but the errors will be equally 
distributed. 

Another option for Eve to invert Alice's Hadamard operation is to delay her mea- 
surement on the qubit pairs 2, P and 3, S until Alice publicly announces whether 
she applied the Hadamard operation or not. That means. Eve intercepts qubits 2 
and 3 in transit between Alice and Bob and immediately forwards qubit R to Alice 
(cf. picture (2) in figure [5]). Alice, convinced to have received Bob's qubit, applies 
the Hadamard operation and performs the Bell state measurement on qubits 1 and 
R (cf. pictures (3)-(5) in figure O. Due to entanglement swapping qubit 2 is now 
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entangled with qubits P, Q, S, T and U , as described in 
\ ® (|000000)pQ2STO 

+ |010111)PQ2STO + |011010)PQ2STC/ - 
+ |101011)PQ2STC/ + |110001)PQ2STC/ - 



eq. 



2V2 

+ |010111>PQ2STO 
- |101011>PQ25TO 



|011010)PQ2STC/ 4 
110001>PQ25TO - 

|*+)lfl.®4'''^''^^(|000101)pQ25TO 

|011111)pq2St;7 4 

|110100>PQ2STC/4 

J000101)PQ25TO 
- |011111>PQ2STC/4 

|110100)PQ2STO- 



- |010010)PQ2STC/ 
|101110)PQ2STO + 

+ 1010010) PQ2STt/ 
- |101110)PQ2STO 



1001101) PQ2STU 
|100110)PQ2STC/ 

|111100)pq2Sto) 

|001101)PQ2STC/ 
|100110)PQ2STO 

|111100)pq2Sto) 

1001000) PQ2STC/ 
|100011)PQ2STC/ 
|111001)PQ2STC/) 

1001000) PQ2STC/ 
|100011)PQ25TO 

|111001)pQ2STC/) )(22) 



Here, Eve does not know in which state her qubits 2, P, Q, S , T and U are be- 
cause she does not know Alice's result. But for our further considerations we assume 

( p) 

that Alice's result is \'if~)iR, i.e. Eve is in possession of some state a\ pq2STU 
similar to her initial state \5) pq2Stu ■ Next, Alice publicly announces that she ap- 
plied the Hadamard operation. Having that knowledge Eve applies a H operation 
on qubits 2 and Q in her possession inverting the effect of Alice H operation and 
preparing for Bob's H operation (cf. picture (7) in figure [5])- Then she sends qubit 
Q to Bob and performs a Bell state measurement on qubits 3 and S which changes 
the state to \5') pQ2iTU ■ Finally, Bob inverts the Hadamard operation due to 
Alice's public announcement (cf. picture (8) in figure[5]). Similar to eq.[5]Bob's Bell 
state measurement on qubits Q and 4 can be described as 



'T\5')PQ2ATU = \{ - I*+)q4«) |$">P2 ® |$+) 



1$ 

- I*">Q4 
+ |* + 



P2 • 



Q4 ' 
Q4 



*")P2 
* + )p2 



1$ 



TU 



TU 



TU 



(23) 



It is easy to see that Bob's obtains every Bell state with equal probability of 25%, 
i.e. his and Alice's results are completely uncorrelated. In case Alice does not apply 
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the Hadamard operation Eve will introduce the same error rate. Therefore, the 
probability Eve will be detected is 



1111 
2 ' 4 ^ 2 ' 4 



1 



(24) 



which converges much faster to 1 compared to the first strategy described above 
(cf. eq.IIll). 

6. Conclusion 

We showed that the protocol presented by Li et al. ^ is open to an attack strategy 
where Eve entangles herself with both legitimate communication parties. Using a 
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Fig. 4. An illustration of the attack on the modified protocol as described in section |5] Eve 
follows the strategy presented in section |3] and Alice has chosen to apply the Hadamard operation. 
Again, tJa, is Alice's secret operation and \^~)ir is Alice's result of the Bell state measurement. 
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special 6-qubit state which preserves the correlated results of entanglement swap- 
ping an adversary is able to obtain full information about the key Alice and Bob 
share in the end. We also discussed an improvement where Alice uses a Hadamard 
transformation on one qubit to secure the protocol. We showed that due to the 
change of the initial state caused by the Hadamard operation an adversary will be 
detected with a high probability. 
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Appendix. Generation of Eve's Initial State 

Eve's initial state \6) pqrstu from eq. ([5|) is rather complex and it might not be 
producible due to today's physical limitations. Nevertheless, we can show that it is, 
in principle, possible for Eve to generate this state using a sequence of Hadamard 
operations and controlled Pauli operations. 

First we assume that Eve is in possession of 3 sources emitting Bell states. The 
state of these 6 qubits is 

|«'")pi?<» |*+)qs(» (25) 

Eve performs a Hadamard operation H on qubits P and Q (indicated by the su- 
perscripts (P) and (Q)), which alters the initial state first to 

ff<'')|$">p/i® |$+)q5® (26) 

and further to 




- I* )pR(E)\^ )qs «) |«'+)tc/ - I* )PP«) |*+)q5® |$+)TC/j (27) 

Then Eve applies a operation on qubit Q if qubits P and R are in the Bell state 
\^^)pR. Otherwise the identity operator is applied. This action can be described 
as 

!$+)($+ 1 (g)cr^(8)/(g)/(g)/ + |$")($^| 
+ |*+)(*+| ® - 1(g) 1(g) 1(g) I (28) 

and it changes the state to 

^ ( |$+)pp ® |*+)qs ® + |$+)pp ® |*")qs ® 1*+)™ 

+ |*")pp«)|«'^)qs«)|$+)t;7 + |*")pp«)|*+)qs® (29) 

Next Eve performs a ax operation on qubit P and a CTz on qubit T if qubits Q and 
5 are in the state |$~)qs- Alternatively, she performs a Uz operation on qubit P 
and a ax operation on qubit T if qubits qubits Q and S are in the state |\I'"'")(3s. If 
qubits Q and S are in the state |\1/~)qs Eve applies a iay operation on both qubits 
P and T. These three controlled operation can be stated as 

Ig)Ig) |$+) ($+ 1 (g) / (g) / cr^ (g) / (g) |$") I (g) cr^ (g) / 

-hcr^ g)/g) If+Xf+I g) ax g) I + iay g) I g) g)iayg)I (30) 

Using this operator Eve is able to bring the 6 qubits into the desired state from eq. 
©• 
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